What happened
At the end of November 2023 Health New Zealand became aware of an unauthorised release of data, and an Employment Relations Authority non-publication order was made on 1 December 2023 [twora-hnz-misinfo]. Health NZ said a former staff member was allegedly involved [twora-hnz]. Personal information of COVID-19 vaccinators was posted on a US-based blog, and altered/anonymised vaccination data was published overseas; Health NZ acknowledged in December 2023 that a small number of vaccinated people could potentially be identified from it [twora-hnz-u3], [onenews-hnz-dec]. In February 2024 Health NZ began notifying around 12,000 people, primarily vaccinators [twora-hnz-u3], [onenews-hnz].
Timeline
- 2023-11 — Health NZ became aware of the unauthorised data release [twora-hnz-misinfo].
- 2023-12-01 — Employment Relations Authority non-publication order made [twora-hnz-misinfo].
- 2023-12-19 — Health NZ publicly acknowledged some individuals could be identified [onenews-hnz-dec].
- 2024-02-16 — Notifications to around 12,000 people began [twora-hnz-u3], [onenews-hnz].
Current status
Disclosed. Police charged the former employee with accessing a computer system for a dishonest purpose, and the case went before the courts [twora-hnz]. These are allegations; the outcome has not been verified from a reputable source and is not stated here. Health NZ said it was working closely with the Office of the Privacy Commissioner [twora-hnz]. The ~12,000 figure is as stated by Health NZ and may rise.
Why it matters
An alleged insider case — the risk isn’t only external attackers; trusted access to sensitive health data can be misused from within.